一、情况说明:

由于系统目前使用的SSL证书是免费证书,需要每3个月进行申请替换,因此需要在腾讯云申请免费证书,选择手动DNS验证,随后进行阿里云域名解析,解析完成后,腾讯云进行验证域名,随后下载新的证书,并进行更新证书文件(.crt)和授权私钥(.key)到云服务器(因为部分应用部署在了云服务器上),随后在浏览器上访问该域名,发现能正常访问,但是后端定时器访问会报错,报错内容如下:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:377)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:320)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:315)
        at sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1349)
        at sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1224)
        at sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1167)
        at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:376)
        at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:479)
        at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:457)
        at sun.security.ssl.TransportContext.dispatch(TransportContext.java:200)
        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:155)
        at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1382)
        at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1295)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:417)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:389)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:558)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:201)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1621)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1549)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:268)
        ...

二、问题解析

可能是Java 运行时无法验证服务器的 SSL 证书;因此需要将证书导入Java的信任库中

三、问题解决

# 1.进入java目录下的cacerts的所有证书
cd /home/xxx/java/jdk1.8.0_121/jre/lib/security

# 2.查看部署在云服务器上的应用对应的证书
keytool -list -keystore cacerts  | grep xxx

# 3.将之前的旧证书进行删除,若之前已删除则跳过
keytool -delete -alias  xxx.com  -keystore  cacerts -storepass changeit

# 4.将上传至服务器的.crt证书文件添加进cacertes证书库中
keytool -import -alias  <证书别名>  -file  <crt证书路径> -keystore cacerts -storepass  changeit

# 5.重启tomcat服务
ps -ef |grep tomcat

kill - 15 进程号

./startup.sh

随后查看控制台,发现应用访问不报错了

参考文档:

java导入可信任证书_将不信任的证书加入到jvm默认信任证书-CSDN博客